Vulnerabilities

TI-2022-04279 CVE-2022-4681 · GHSA-6vgw-7v97-h3ch

Hide My WP < 6.2.9 - Unauthenticated SQLi

HIGH 82

The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03824 Published 2023-02-06 Fixed in 6.2.9

TI-2021-14997 CVE-2021-36916 · GHSA-53q2-99ph-73wh

WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability

MEDIUM 52

The SQL injection vulnerability in the Hide My WP WordPress plugin (versions <= 6.2.3) is possible because of how the IP address is retrieved and used inside a SQL query.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01861 Published 2021-11-24 No fix listed CWE-89

TI-2021-14998 CVE-2021-36917 · GHSA-g6pf-m72v-9jx7

WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability

MEDIUM 43

WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02005 Published 2021-11-24 No fix listed CWE-284

Vulnerabilities

Filters

Hide My WP < 6.2.9 - Unauthenticated SQLi

WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability

WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability